Bug 1890314

1. Proposed title of this feature request

    allow unprivileged use of repomanage et. al.

2. Who is the customer behind the request?

    Bloomberg / The Bureau of National Affairs Inc

Account: Bloomberg BNA 600069
TAM customer: no
CSM customer: no
Strategic: presumed no, unclear

3. What is the nature and description of the request?

Restore behaviour similar to RHEL 7 default.

4. Why does the customer need this? (List the business requirements here)

Automated processes snarled up with extraneous errors.

5. How would the customer like to achieve this? (List the functional requirements here)

Revert behaviour to previous defaults.

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

Inherent in request.

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?

1890314 filed for this

8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?

RHEL 8

9. Is the sales team involved in this request and do they have any additional input?

Not involved as yet.

10. List any affected packages or components.

1890314

11. Would the customer be able to assist in testing this functionality if implemented?

yes

Turns out this is a general issue not specific to repomanage.

The error messages come from subscription-manager (therefore a possible workaround is to use --disableplugin=subscription-manager if its not needed) and they show up for any dnf command run as unprivileged (non-root) user.

It is very similar to https://bugzilla.redhat.com/show_bug.cgi?id=1876841, maybe could even be considered duplicate, but like I mentioned the problem is not limited to repomanage and reposync.

Reproducing the bug :
==================

# subscription-manager version
server type: This system is currently not registered.
subscription management server: 3.2.19-1
subscription management rules: 5.41
subscription-manager: 1.28.19-1.el8

# su - test
$ mkdir repo
$ repomanage repo/
2021-07-30 05:42:29,505 [ERROR] repomanage:40212:MainThread @logutil.py:221 - [Errno 13] Permission denied: '/var/log/rhsm/rhsm.log' - Further logging output will be written to stderr
Not root, Subscription Management repositories not updated

This system is not registered with an entitlement server. You can use subscription-manager to register.

Error: No files to process

Preverifying the fix on :
==========================

# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 3.2.19-1
subscription management rules: 5.41
subscription-manager: 1.28.19-1.git.6.c1dd7c3.el8

# su - test
Last login: Thu Jul 29 17:24:00 IDT 2021 on pts/0

$ mkdir repo

$ repomanage repo/
Not root, Subscription Management repositories not updated

This system is not registered with an entitlement server. You can use subscription-manager to register.

Error: No files to process

$ tail ~/.cache/rhsm/rhsm.log -n 1
2021-07-29 17:24:21,454 [ERROR] repomanage:54948:MainThread @identity.py:156 - Reload of consumer identity cert /etc/pki/consumer/cert.pem raised an exception with msg: [Errno 13] Permission denied: '/etc/pki/consumer/key.pem'

^ Notice now the error log is added to the rhsm.log entry of non-root user. 

Based on the observation , Pre-verifying the bug

Verifying on :
==============
# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 3.2.19-1
subscription management rules: 5.41
subscription-manager: 1.28.20-1.el8

$ mkdir repo

$ repomanage repo/
Not root, Subscription Management repositories not updated
Error: No files to process

$ tail ~/.cache/rhsm/rhsm.log -n 1
2021-08-09 10:40:20,265 [ERROR] repomanage:17739:MainThread @identity.py:156 - Reload of consumer identity cert /etc/pki/consumer/cert.pem raised an exception with msg: [Errno 13] Permission denied: '/etc/pki/consumer/key.pem'

Based on the above observation , moving the bug to Verified !!

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (subscription-manager bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4390